Deployment Architecture

Is it possible to make a splunk cluster with two servers ?

DavidHourani
Super Champion

Hello,

I was wondering if it is possible to make a Splunk cluster (SH and Indexer cluster) using only two machines.

I was thinking of installing Splunk twice on each machine and configuring different management ports for each Splunk instance. I would then start up one as an indexer and one as a SH on each appliance therefore getting 2 SH and 2 indexers running on separate instances.

Once that is done I would set up SH clustering and clustering for the indexers with SF=2 RF=2 and voilà.

Is such a build possible ? has anyone done it ? what are the pros / cons (kind of obvious questions)

Thanks in advance for your replies.

Best regards,
David

0 Karma
1 Solution

sowings
Splunk Employee
Splunk Employee

Possible? Yes. Advised? Certainly not.

Keeping configurations managed and consistent on two distinct instances per host is tricky, and error-prone. Please don't do this.

I would also point out that this may put you in the "unsupported" category.

I might ask the question "what problem are you trying to solve?" The need for extra instances for Splunk clustering can easily be met with thinly provisioned VMs rather than trying to manage a separate instance on the same host.

View solution in original post

saravanan90
Contributor

Search head clustering couldn't be implemented with two nodes. It requires minimum of three nodes to create a SH cluster.

0 Karma

sowings
Splunk Employee
Splunk Employee

Possible? Yes. Advised? Certainly not.

Keeping configurations managed and consistent on two distinct instances per host is tricky, and error-prone. Please don't do this.

I would also point out that this may put you in the "unsupported" category.

I might ask the question "what problem are you trying to solve?" The need for extra instances for Splunk clustering can easily be met with thinly provisioned VMs rather than trying to manage a separate instance on the same host.

hexx
Splunk Employee
Splunk Employee

@sowings is correct on all accounts. As per our docs:

Each node instance must run on a separate machine or virtual machine, and each machine must be running the same operating system.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...